     :aes256-cbc-hmac-sha512 (bytes/slice key 0 32)))
 
 (defn- generate-authtag
-  [{:keys [algorithm input authkey iv] :as params}]
-  (let [data (bytes/concat iv input)
+  [{:keys [algorithm input authkey iv aad] :as params}]
+  (let [al (if aad
+             (aad->bytes aad)
+             (byte-array 0))
+        data (bytes/concat aad iv input al)
         fulltag (hmac/hash data authkey algorithm)
         truncatesize (quot (count fulltag) 2)]
     (bytes/slice fulltag 0 truncatesize)))

(defmulti decrypt* :algorithm)

(defmethod encrypt* :aes128-cbc-hmac-sha256
  [{:keys [algorithm input key iv ] :as params}]
  {:pre [(keylength? key 32) (ivlength? iv 16)]}
  (let [cipher (block-cipher :aes :cbc)
        encryptionkey (extract-encryption-key key algorithm)

        tag (generate-authtag {:algorithm :sha256
                               :input ciphertext
                               :authkey authkey
                               :aad aad
                               :iv iv})]
    (bytes/concat ciphertext tag)))

